Upside Systems LLC · Last updated: October 18, 2026

This policy explains how Upside Systems LLC ("Upside ESG", "we", "us") collects and uses personal information when you visit upside-esg.com (the "Site"), sign up for our newsletter or resources, book a call, or work with us.

Upside Systems LLC is the controller of your personal information. That means we decide how and why it is used.

• Upside Systems 1414 Glenbrook Road Suite 4 Unit 1414 Stamford, CT 06906 USA
• Email: privacy@upside-esg.com

If you have any questions about this policy or your information, email us at privacy@upside-esg.com.

Information you give us

• Newsletter and resource sign-ups: your email address and, if you choose to give them, your first name and company.
• Download forms (for example, Data room resources and guides): your name, email address, company and any other details the form asks for.
• Booking a call: your name, email address, company and the answers you give when you book a strategy call.
• Emails and messages: what you write to us and our replies.
• Clients: business contact details, billing details and the information you share with us so we can deliver our services.

Information collected automatically

• Analytics (with your consent where the law requires it, such as in the EU, EEA, UK and Switzerland): pages visited, how you found the Site, approximate location (derived from your IP address), device and browser type, and actions such as resource downloads. See our Cookie Policy.
• Basic technical data: our website host processes technical information such as your IP address so the Site can load securely.
• Newsletter engagement: our email provider tells us whether emails were delivered, opened or clicked, so we can keep our list healthy and our content useful.

Information from other sources

When we look for businesses that may benefit from our services, we may collect business contact information about people in relevant roles, such as name, job title, employer, work email and professional profile. We collect this from public sources (such as company websites and professional networks) and from third-party business data providers (such as prospecting databases).

We do not ask for sensitive information (such as health, religion or political views). Please do not send it to us.

Data protection law (including the EU and UK GDPR) requires a lawful basis for each use of personal information. Here is ours:

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for more detail.

Where marketing law requires your prior consent for marketing emails (for example, to individuals in the UK or EU), we ask for it first.

We do not sell or rent your personal information. We share it only with service providers who help us run our business, and only as far as needed. These are:

• Website hosting and analytics providers
• Email marketing and newsletter providers
• Scheduling and booking providers
• File hosting providers (for resource and guide downloads)
• Customer relationship management (CRM) and productivity tools
• AI tools we use to research, analyze and draft work when delivering our services
• Payment and invoicing providers (for clients)
• Professional advisers such as accountants and lawyers

These providers act on our instructions and must protect your information. We may update these providers from time to time. A list of our current providers is available on request: email privacy@upside-esg.com.

The one provider we name here is Google Analytics, because cookie rules require us to tell you which analytics cookies are set. For visitors from the EU, EEA, UK and Switzerland, Google Analytics is used only if you accept analytics cookies. We do not use Google Analytics advertising features or Google Signals.

Our AI tools are set so that our providers do not use client or contact data to train their models.

We may also share information if the law requires it, to protect our rights or the safety of others, or as part of a sale or merger of our business (in which case this policy will continue to apply).

Upside Systems LLC is based in the United States, and many of our service providers are too. If you are in the EU, UK or elsewhere, your information will be transferred to and processed in the US and possibly other countries.

When we transfer personal information from the EU or UK, we rely on recognised safeguards. These include the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for more information about these safeguards.

We keep personal information only as long as we need it. Our standard periods are:

Depending on where you live, you have rights over your personal information. If you are in the EU or UK, you have the right to:

• Access the personal information we hold about you and get a copy
• Correct information that is wrong or incomplete
• Delete your information
• Restrict how we use it
• Data portability: receive your information in a portable format, or have it sent to another organisation
• Object to our use of your information based on legitimate interests
• Object to direct marketing at any time. If you object, we will stop.
• Withdraw consent at any time (for example, unsubscribe from the newsletter or change your cookie settings). This does not affect anything we did before you withdrew it.

United States. If you live in Connecticut, California or another state with a privacy law, you may have similar rights: to know, access, correct, delete and get a copy of your personal data, and to opt out of targeted advertising, profiling and the sale or sharing of personal data. We do not sell personal data.

To use any of these rights, email privacy@upside-esg.com. We will reply within one month (or the time your local law allows) and may need to confirm your identity first. Using your rights is free.

Complaints. If you are unhappy with how we have used your information, please tell us first so we can try to put it right. You also have the right to complain to a data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EU, it is the authority in the country where you live or work. In the US, you can contact your state Attorney General.

We may use software and AI tools to research and prioritise businesses that may be a good fit for our services. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. A person always reviews any decision about whether to contact or work with you.

Our Site and services are for business users. They are not directed to children under 16, and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.

We use reasonable technical and organisational measures to protect your information, including access controls and encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We use strictly necessary cookies and analytics cookies. Visitors from the EU, EEA, UK and Switzerland get analytics cookies only with their consent. Our Cookie Policy explains which cookies we use and how to change your choices.

Website visitor analytics. We use Apollo.io to understand which organisations visit the Site. Apollo sets a first-party cookie and uses information such as your IP address and the pages you view to match a visit to company-level information (for example, company name, industry and size). We use this to understand interest in our services and to improve our outreach. We do not use it to identify you personally. You can block or delete cookies in your browser settings. For more information, see Apollo's privacy policy.

Our Site links to other websites and services, such as our booking page and newsletter page. Their own privacy policies apply when you use them.

We may update this policy from time to time. We will change the "Last updated" date at the top and, for significant changes, tell you in another way where appropriate (for example, by email or a notice on the Site).

• Upside Systems 1414 Glenbrook Road Suite 4 Unit 1414 Stamford, CT 06906
• USA
• Email: privacy@upside-esg.com